Transparency

AI Use Declaration

TenantSage's job is to govern AI systems. It's fair to ask where AI shows up inside TenantSage itself, and where a human is deliberately kept in the loop. This page answers that plainly.

Where AI is involved

Two places, both bounded by governance rather than exempt from it.

S6 · Generation

TenantSage is model-agnostic: it invokes whichever LLM the customer has configured to produce a response or a proposed action from the governed context it's been handed. TenantSage doesn't train or fine-tune that model, and doesn't see anything the model wasn't already permitted to see.

S7 · Validation

Automated checks assess whether a response is grounded in the retrieved evidence, whether it discloses anything it shouldn't, and whether it passes basic content-safety screening — before it's released.

Where a human has to be involved

Automated validation is not the same as approval.

Any request that resolves into a candidate action — sending something, changing something, executing a transaction — stops at S8, Validation Approval, and does not continue without an authorized human decision. This isn't a configurable convenience feature; it's a structural stage in the pipeline. An AI system integrated with TenantSage cannot approve its own actions.

What we don't claim

Limits, stated directly.

That the underlying LLM won't hallucinate That validation catches every ungrounded claim That generation quality is TenantSage's responsibility

TenantSage's guarantee is about what evidence the model was allowed to see, and that every step is provable after the fact — not about the correctness of what the model chooses to say with that evidence. Those are different problems, and conflating them understates the second one.

Operating principles

The rules this system holds itself to.

FAIL-CLOSED

An ambiguous or failed check is treated as a denial, never as a pass-through.

DENY PRECEDENCE

If any stage would deny, the most restrictive applicable outcome wins.

TYPED DENIALS

Every refusal names a specific, inspectable reason — never a silent drop.